@vinaes/succ 1.4.0 → 1.5.37

package/dist/lib/ifc/file-labels.js

@@ -0,0 +1,208 @@
+/**
+ * File Label Assignment — 4-layer label resolution for BLP IFC
+ *
+ * Assigns SecurityLabels to files using conservative (highest wins) layering:
+ *   1. Extension-based (deterministic, instant)
+ *   2. Path-based (deterministic, instant)
+ *   3. Content-based regex (deterministic, requires file content)
+ *   4. LLM classification (Phase 3, opt-in)
+ *
+ * Label assignment is monotonic — higher label always wins.
+ */
+import { makeLabel, join, BOTTOM, } from './label.js';
+const EXTENSION_RULES = [
+    // Highly confidential: private keys and certs
+    {
+        extensions: ['.pem', '.key', '.p12', '.pfx', '.jks', '.keystore'],
+        label: makeLabel(3, ['credentials']),
+    },
+    // Confidential: environment files with secrets
+    {
+        extensions: ['.env', '.env.local', '.env.production', '.env.staging', '.env.development'],
+        label: makeLabel(2, ['secrets', 'credentials']),
+    },
+    // Internal: config files that may contain infrastructure info
+    {
+        extensions: ['.htpasswd', '.htaccess'],
+        label: makeLabel(2, ['credentials']),
+    },
+    // Public: documentation
+    {
+        extensions: ['.md', '.txt', '.rst', '.adoc'],
+        label: BOTTOM,
+    },
+];
+function labelByExtension(filePath) {
+    const lower = filePath.toLowerCase().replace(/\\/g, '/');
+    const basename = lower.split('/').pop() || '';
+    // Check full basename match first (for .env, .env.local, .env.production, etc.)
+    for (const rule of EXTENSION_RULES) {
+        for (const ext of rule.extensions) {
+            const name = ext.slice(1); // e.g. "env", "env.local", "pem"
+            // Exact match: ".env" → basename ".env"
+            if (basename === ext || basename === name) {
+                return rule.label;
+            }
+            // Prefix match: ".env" rule matches ".env.production", ".env.staging", etc.
+            // But NOT env.sh, env.py, etc. — only .env.* or bare env files
+            if (ext === '.env' && basename.startsWith('.env.')) {
+                return rule.label;
+            }
+            // Match bare "env" followed by dot-separated qualifiers (env.local, env.production)
+            // but NOT env.sh, env.py, env.ts, etc. (script files)
+            if (ext === '.env' && basename.startsWith('env.')) {
+                const afterEnvDot = basename.slice(4); // after "env."
+                // If it looks like a file extension (2-4 chars, common code ext), skip
+                if (/^(?:sh|py|ts|js|rb|go|rs|pl|bat|cmd|ps1|php|java|c|h|cpp)$/i.test(afterEnvDot)) {
+                    // Not an env config file — skip
+                }
+                else {
+                    return rule.label;
+                }
+            }
+        }
+    }
+    // Check all extensions in compound filenames (e.g., "backup.pem.bak" → check ".bak", ".pem")
+    // This ensures security-sensitive inner extensions aren't missed when outer extension differs
+    let compoundLabel = BOTTOM;
+    let remaining = basename;
+    while (true) {
+        const dotIdx = remaining.lastIndexOf('.');
+        if (dotIdx < 0)
+            break;
+        const ext = remaining.slice(dotIdx);
+        for (const rule of EXTENSION_RULES) {
+            if (rule.extensions.includes(ext)) {
+                compoundLabel = join(compoundLabel, rule.label);
+            }
+        }
+        remaining = remaining.slice(0, dotIdx);
+    }
+    return compoundLabel;
+}
+const PATH_RULES = [
+    // Secrets directories
+    { pattern: /[/\\]secrets?[/\\]/i, label: makeLabel(3, ['secrets']) },
+    { pattern: /[/\\]\.ssh[/\\]/i, label: makeLabel(3, ['credentials']) },
+    { pattern: /[/\\]\.gnupg[/\\]/i, label: makeLabel(3, ['credentials']) },
+    { pattern: /[/\\]private[/\\]/i, label: makeLabel(2, ['credentials']) },
+    // Infrastructure
+    { pattern: /[/\\]deploy[/\\]/i, label: makeLabel(2, ['internal_infra']) },
+    { pattern: /[/\\]infrastructure[/\\]/i, label: makeLabel(2, ['internal_infra']) },
+    { pattern: /[/\\]terraform[/\\]/i, label: makeLabel(2, ['internal_infra']) },
+    { pattern: /[/\\]k8s[/\\]/i, label: makeLabel(2, ['internal_infra']) },
+    { pattern: /[/\\]kubernetes[/\\]/i, label: makeLabel(2, ['internal_infra']) },
+    { pattern: /[/\\]ansible[/\\]/i, label: makeLabel(2, ['internal_infra']) },
+    // CI/CD configs (may contain deployment secrets)
+    { pattern: /[/\\]\.github[/\\]workflows[/\\]/i, label: makeLabel(1, ['internal_infra']) },
+    { pattern: /[/\\]\.gitlab-ci\.yml$/i, label: makeLabel(1, ['internal_infra']) },
+    { pattern: /[/\\]\.circleci[/\\]/i, label: makeLabel(1, ['internal_infra']) },
+    // Skip: node_modules, .git internals — not sensitive per se
+    { pattern: /[/\\]node_modules[/\\]/i, label: BOTTOM },
+    { pattern: /[/\\]\.git[/\\]/i, label: makeLabel(1) },
+];
+function labelByPath(filePath) {
+    let normalized = filePath.replace(/\\/g, '/');
+    // Ensure repo-relative paths (e.g., "secrets/key.pem") match PATH_RULES that require /dir/ delimiters
+    if (!normalized.startsWith('/')) {
+        normalized = '/' + normalized;
+    }
+    let result = BOTTOM;
+    for (const rule of PATH_RULES) {
+        if (rule.pattern.test(normalized)) {
+            result = join(result, rule.label);
+        }
+    }
+    return result;
+}
+const CONTENT_PATTERNS = [
+    // API keys / tokens (→ secrets)
+    { pattern: /sk-(?:proj-)?[a-zA-Z0-9]{20,}/, compartments: ['secrets'], level: 3 },
+    { pattern: /sk-ant-[a-zA-Z0-9-]{20,}/, compartments: ['secrets'], level: 3 },
+    { pattern: /AKIA[0-9A-Z]{16}/, compartments: ['secrets'], level: 3 },
+    { pattern: /gh[pousr]_[a-zA-Z0-9]{36}/, compartments: ['secrets'], level: 3 },
+    { pattern: /github_pat_[a-zA-Z0-9]{22,}/, compartments: ['secrets'], level: 3 },
+    { pattern: /glpat-[a-zA-Z0-9-]{20,}/, compartments: ['secrets'], level: 3 },
+    {
+        pattern: /xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}/,
+        compartments: ['secrets'],
+        level: 3,
+    },
+    {
+        pattern: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/,
+        compartments: ['secrets'],
+        level: 2,
+    },
+    // Private keys (→ credentials)
+    {
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+        compartments: ['credentials'],
+        level: 3,
+    },
+    // Password assignments (→ secrets)
+    {
+        pattern: /(?:password|passwd|secret|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/,
+        compartments: ['secrets'],
+        level: 2,
+    },
+    // Connection strings (→ credentials + internal_infra)
+    {
+        pattern: /(?:postgres|mysql|mongodb|redis):\/\/[^:]+:[^@]+@/,
+        compartments: ['credentials', 'internal_infra'],
+        level: 2,
+    },
+    // PII patterns
+    { pattern: /\b\d{3}-\d{2}-\d{4}\b/, compartments: ['pii'], level: 2 }, // SSN
+    { pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z]{2,}\b/i, compartments: ['pii'], level: 1 }, // Email (low level — very common)
+    // Internal infrastructure markers
+    {
+        pattern: /(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/,
+        compartments: ['internal_infra'],
+        level: 1,
+    },
+];
+/**
+ * Scan file content for sensitive patterns and return accumulated label.
+ * Short-circuits if content is empty.
+ */
+export function labelByContent(content) {
+    if (!content || content.length === 0)
+        return BOTTOM;
+    let result = BOTTOM;
+    for (const { pattern, compartments, level } of CONTENT_PATTERNS) {
+        if (pattern.test(content)) {
+            result = join(result, makeLabel(level, compartments));
+        }
+    }
+    return result;
+}
+/**
+ * Resolve the security label for a file using 3 deterministic layers.
+ * Returns the join (LUB) of all applicable labels.
+ *
+ * Layer 4 (LLM classification) is handled externally in Phase 3.
+ */
+export function resolveFileLabel(filePath, options = {}) {
+    // Normalize relative paths to have path separators for path-based rules
+    const normalizedPath = filePath.includes('/') || filePath.includes('\\') ? filePath : './' + filePath;
+    let result = BOTTOM;
+    // Layer 1: Extension
+    result = join(result, labelByExtension(normalizedPath));
+    // Layer 2: Path
+    result = join(result, labelByPath(normalizedPath));
+    // Layer 3: Content (if provided)
+    if (options.content) {
+        result = join(result, labelByContent(options.content));
+    }
+    return result;
+}
+/**
+ * Quick label check — extension + path only (no content scan).
+ * Use for pre-tool checks where content isn't available yet.
+ */
+export function quickFileLabel(filePath) {
+    return join(labelByExtension(filePath), labelByPath(filePath));
+}
+// Re-export for convenience
+export { BOTTOM, makeLabel, join, isBottom, } from './label.js';
+//# sourceMappingURL=file-labels.js.map

package/dist/lib/ifc/file-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-labels.js","sourceRoot":"","sources":["../../../src/lib/ifc/file-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAIL,SAAS,EACT,IAAI,EACJ,MAAM,GACP,MAAM,YAAY,CAAC;AASpB,MAAM,eAAe,GAAoB;IACvC,8CAA8C;IAC9C;QACE,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC;QACjE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;KACrC;IACD,+CAA+C;IAC/C;QACE,UAAU,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,kBAAkB,CAAC;QACzF,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;KAChD;IACD,8DAA8D;IAC9D;QACE,UAAU,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;QACtC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;KACrC;IACD,wBAAwB;IACxB;QACE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;QAC5C,KAAK,EAAE,MAAM;KACd;CACF,CAAC;AAEF,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAE9C,gFAAgF;IAChF,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC;YAC5D,wCAAwC;YACxC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;YACD,4EAA4E;YAC5E,+DAA+D;YAC/D,IAAI,GAAG,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;YACD,oFAAoF;YACpF,sDAAsD;YACtD,IAAI,GAAG,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;gBACtD,uEAAuE;gBACvE,IAAI,6DAA6D,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBACpF,gCAAgC;gBAClC,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,8FAA8F;IAC9F,IAAI,aAAa,GAAG,MAAM,CAAC;IAC3B,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM;QACtB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AASD,MAAM,UAAU,GAAe;IAC7B,sBAAsB;IACtB,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE;IACpE,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE;IACrE,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE;IACvE,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE;IAEvE,iBAAiB;IACjB,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IACzE,EAAE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IACjF,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IAC5E,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IACtE,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IAC7E,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IAE1E,iDAAiD;IACjD,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IACzF,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IAC/E,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE;IAE7E,4DAA4D;IAC5D,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;IACrD,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;CACrD,CAAC;AAEF,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,sGAAsG;IACtG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,MAAM,gBAAgB,GAAqB;IACzC,gCAAgC;IAChC,EAAE,OAAO,EAAE,+BAA+B,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;IACjF,EAAE,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;IAC5E,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;IACpE,EAAE,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;IAC7E,EAAE,OAAO,EAAE,6BAA6B,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;IAC/E,EAAE,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;IAC3E;QACE,OAAO,EAAE,sDAAsD;QAC/D,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,CAAC;KACT;IACD;QACE,OAAO,EAAE,sDAAsD;QAC/D,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,CAAC;KACT;IAED,+BAA+B;IAC/B;QACE,OAAO,EAAE,wDAAwD;QACjE,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,KAAK,EAAE,CAAC;KACT;IAED,mCAAmC;IACnC;QACE,OAAO,EAAE,+DAA+D;QACxE,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,CAAC;KACT;IAED,sDAAsD;IACtD;QACE,OAAO,EAAE,mDAAmD;QAC5D,YAAY,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;QAC/C,KAAK,EAAE,CAAC;KACT;IAED,eAAe;IACf,EAAE,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM;IAC7E,EAAE,OAAO,EAAE,kDAAkD,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,kCAAkC;IAEpI,kCAAkC;IAClC;QACE,OAAO,EACL,0GAA0G;QAC5G,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAChC,KAAK,EAAE,CAAC;KACT;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpD,IAAI,MAAM,GAAG,MAAM,CAAC;IAEpB,KAAK,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAA4B,EAAE;IAC/E,wEAAwE;IACxE,MAAM,cAAc,GAClB,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC;IAEjF,IAAI,MAAM,GAAG,MAAM,CAAC;IAEpB,qBAAqB;IACrB,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;IAExD,gBAAgB;IAChB,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAEnD,iCAAiC;IACjC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,4BAA4B;AAC5B,OAAO,EACL,MAAM,EACN,SAAS,EACT,IAAI,EACJ,QAAQ,GAGT,MAAM,YAAY,CAAC"}

package/dist/lib/ifc/label.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Bell-LaPadula Security Label Lattice
+ *
+ * Full BLP model with compartments:
+ * - SecurityLevel: 0=public, 1=internal, 2=confidential, 3=highly_confidential
+ * - Compartments: secrets, credentials, pii, internal_infra
+ * - Lattice operations: join (LUB), dominates, isBottom, isComparable
+ *
+ * Label rules:
+ * - Labels only go UP (weak tranquility)
+ * - join(a, b) = max level + union compartments
+ * - dominates(a, b) = a.level >= b.level AND a.compartments ⊇ b.compartments
+ */
+export type SecurityLevel = 0 | 1 | 2 | 3;
+export declare const LEVEL_NAMES: Record<SecurityLevel, string>;
+export type Compartment = 'secrets' | 'credentials' | 'pii' | 'internal_infra';
+export declare const ALL_COMPARTMENTS: readonly Compartment[];
+export interface SecurityLabel {
+    readonly level: SecurityLevel;
+    readonly compartments: ReadonlySet<Compartment>;
+}
+/** The bottom of the lattice — no classification, no compartments */
+export declare const BOTTOM: SecurityLabel;
+/** Create a label */
+export declare function makeLabel(level: SecurityLevel, compartments?: Compartment[]): SecurityLabel;
+/** Least Upper Bound — max level, union of compartments */
+export declare function join(a: SecurityLabel, b: SecurityLabel): SecurityLabel;
+/** Does `a` dominate `b`? (a.level >= b.level AND a.compartments ⊇ b.compartments) */
+export declare function dominates(a: SecurityLabel, b: SecurityLabel): boolean;
+/** Is label at the bottom of the lattice? */
+export declare function isBottom(label: SecurityLabel): boolean;
+/** Are two labels comparable? (one dominates the other) */
+export declare function isComparable(a: SecurityLabel, b: SecurityLabel): boolean;
+/** Are two labels equal? */
+export declare function labelsEqual(a: SecurityLabel, b: SecurityLabel): boolean;
+/** Format label for display */
+export declare function formatLabel(label: SecurityLabel): string;
+//# sourceMappingURL=label.d.ts.map

package/dist/lib/ifc/label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"label.d.ts","sourceRoot":"","sources":["../../../src/lib/ifc/label.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE1C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAKrD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,KAAK,GAAG,gBAAgB,CAAC;AAE/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,WAAW,EAKzC,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,qEAAqE;AACrE,eAAO,MAAM,MAAM,EAAE,aAGF,CAAC;AAEpB,qBAAqB;AACrB,wBAAgB,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,GAAE,WAAW,EAAO,GAAG,aAAa,CAK/F;AAED,2DAA2D;AAC3D,wBAAgB,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,aAAa,CAItE;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAMrE;AAED,6CAA6C;AAC7C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAEtD;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAExE;AAED,4BAA4B;AAC5B,wBAAgB,WAAW,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAOvE;AAED,+BAA+B;AAC/B,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAIxD"}

package/dist/lib/ifc/label.js

@@ -0,0 +1,80 @@
+/**
+ * Bell-LaPadula Security Label Lattice
+ *
+ * Full BLP model with compartments:
+ * - SecurityLevel: 0=public, 1=internal, 2=confidential, 3=highly_confidential
+ * - Compartments: secrets, credentials, pii, internal_infra
+ * - Lattice operations: join (LUB), dominates, isBottom, isComparable
+ *
+ * Label rules:
+ * - Labels only go UP (weak tranquility)
+ * - join(a, b) = max level + union compartments
+ * - dominates(a, b) = a.level >= b.level AND a.compartments ⊇ b.compartments
+ */
+export const LEVEL_NAMES = {
+    0: 'public',
+    1: 'internal',
+    2: 'confidential',
+    3: 'highly_confidential',
+};
+export const ALL_COMPARTMENTS = [
+    'secrets',
+    'credentials',
+    'pii',
+    'internal_infra',
+];
+/** The bottom of the lattice — no classification, no compartments */
+export const BOTTOM = Object.freeze({
+    level: 0,
+    compartments: Object.freeze(new Set()),
+});
+/** Create a label */
+export function makeLabel(level, compartments = []) {
+    return {
+        level,
+        compartments: new Set(compartments),
+    };
+}
+/** Least Upper Bound — max level, union of compartments */
+export function join(a, b) {
+    const level = Math.max(a.level, b.level);
+    const compartments = new Set([...a.compartments, ...b.compartments]);
+    return { level, compartments };
+}
+/** Does `a` dominate `b`? (a.level >= b.level AND a.compartments ⊇ b.compartments) */
+export function dominates(a, b) {
+    if (a.level < b.level)
+        return false;
+    for (const c of b.compartments) {
+        if (!a.compartments.has(c))
+            return false;
+    }
+    return true;
+}
+/** Is label at the bottom of the lattice? */
+export function isBottom(label) {
+    return label.level === 0 && label.compartments.size === 0;
+}
+/** Are two labels comparable? (one dominates the other) */
+export function isComparable(a, b) {
+    return dominates(a, b) || dominates(b, a);
+}
+/** Are two labels equal? */
+export function labelsEqual(a, b) {
+    if (a.level !== b.level)
+        return false;
+    if (a.compartments.size !== b.compartments.size)
+        return false;
+    for (const c of a.compartments) {
+        if (!b.compartments.has(c))
+            return false;
+    }
+    return true;
+}
+/** Format label for display */
+export function formatLabel(label) {
+    const level = LEVEL_NAMES[label.level];
+    const comps = [...label.compartments].sort().join(', ');
+    return comps ? `${level} {${comps}}` : level;
+}
+//# sourceMappingURL=label.js.map

package/dist/lib/ifc/label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"label.js","sourceRoot":"","sources":["../../../src/lib/ifc/label.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAkC;IACxD,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,cAAc;IACjB,CAAC,EAAE,qBAAqB;CACzB,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,SAAS;IACT,aAAa;IACb,KAAK;IACL,gBAAgB;CACR,CAAC;AAOX,qEAAqE;AACrE,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC;IACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,EAAe,CAAC;CACpD,CAAkB,CAAC;AAEpB,qBAAqB;AACrB,MAAM,UAAU,SAAS,CAAC,KAAoB,EAAE,eAA8B,EAAE;IAC9E,OAAO;QACL,KAAK;QACL,YAAY,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,IAAI,CAAC,CAAgB,EAAE,CAAgB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAc,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,CAAgB,EAAE,CAAgB;IAC1D,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,OAAO,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,CAAgB,EAAE,CAAgB;IAC7D,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,WAAW,CAAC,CAAgB,EAAE,CAAgB;IAC5D,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,WAAW,CAAC,KAAoB;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC"}

package/dist/lib/ifc/session-ifc.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Session IFC State — Bell-LaPadula enforcement per session
+ *
+ * Tracks the security high-water mark for each session:
+ * - Labels only go UP (weak tranquility / monotonic)
+ * - Taints accumulate and never clear
+ * - Outbound operations are checked against *-property (no write down)
+ * - Users can grant one-shot trusted-subject escalations
+ *
+ * State is in-memory, discarded on session end. New session = clean slate.
+ */
+import { type SecurityLabel, type SecurityLevel, type Compartment } from './label.js';
+export type SecurityTaint = 'secrets_detected' | 'credentials_detected' | 'pii_detected' | 'prompt_injection' | 'high_entropy_output';
+export interface LabelHistoryEntry {
+    timestamp: number;
+    previousLevel: SecurityLevel;
+    newLevel: SecurityLevel;
+    previousCompartments: Compartment[];
+    newCompartments: Compartment[];
+    trigger: string;
+}
+export interface SessionIFCState {
+    label: SecurityLabel;
+    taints: Set<SecurityTaint>;
+    outboundStepCount: number;
+    labelHistory: LabelHistoryEntry[];
+    trustedActions: Set<string>;
+    /** Permission mode registered at session start (trusted source of truth for bypass detection) */
+    permissionMode?: string;
+}
+export type OutboundChannel = 'file_write' | 'bash_network' | 'web_fetch' | 'git_commit' | 'memory_save';
+export interface WriteDownCheckResult {
+    allowed: boolean;
+    action: 'allow' | 'deny' | 'ask' | 'warn';
+    reason?: string;
+}
+export interface IFCStepLimits {
+    highly_confidential: number;
+    confidential: number;
+}
+export declare function createSessionIFC(): SessionIFCState;
+/**
+ * Raise the session label (monotonic — can only go up).
+ * Returns true if the label actually changed.
+ */
+export declare function raiseLabel(state: SessionIFCState, fileLabel: SecurityLabel, trigger: string): boolean;
+/**
+ * Add a taint to the session (accumulative, never removed).
+ */
+export declare function addTaint(state: SessionIFCState, taint: SecurityTaint, source: string): void;
+/**
+ * Grant a one-shot trusted-subject escalation.
+ * The action ID should be unique per operation (e.g., "bash:curl:step42").
+ */
+export declare function grantTrustedAction(state: SessionIFCState, actionId: string): void;
+/**
+ * Consume a trusted action (one-shot — removed after use).
+ * Returns true if the action was granted and is now consumed.
+ */
+export declare function consumeTrustedAction(state: SessionIFCState, actionId: string): boolean;
+/**
+ * Check if an outbound operation is allowed under BLP *-property.
+ *
+ * Graduated enforcement:
+ * - highly_confidential (3): deny all outbound unconditionally
+ * - confidential (2): deny if tainted, ask otherwise
+ * - internal (1): warn only
+ * - public (0): no restriction
+ *
+ * For file_write, caller must provide the destination file's label.
+ */
+export declare function checkWriteDown(state: SessionIFCState, channel: OutboundChannel, options?: {
+    destinationLabel?: SecurityLabel;
+    actionId?: string;
+    stepLimits?: Partial<IFCStepLimits>;
+}): WriteDownCheckResult;
+/**
+ * Increment outbound step counter. Call after every outbound operation.
+ */
+export declare function recordOutboundStep(state: SessionIFCState): void;
+export interface SessionIFCSummary {
+    level: SecurityLevel;
+    levelName: string;
+    compartments: Compartment[];
+    taints: SecurityTaint[];
+    outboundStepCount: number;
+    historyLength: number;
+    trustedActionsCount: number;
+    formattedLabel: string;
+}
+export declare function summarizeIFC(state: SessionIFCState): SessionIFCSummary;
+//# sourceMappingURL=session-ifc.d.ts.map

package/dist/lib/ifc/session-ifc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ifc.d.ts","sourceRoot":"","sources":["../../../src/lib/ifc/session-ifc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EAOjB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,sBAAsB,GACtB,cAAc,GACd,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,aAAa,CAAC;IACxB,oBAAoB,EAAE,WAAW,EAAE,CAAC;IACpC,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,cAAc,GACd,WAAW,GACX,YAAY,GACZ,aAAa,CAAC;AAElB,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAsBD,wBAAgB,gBAAgB,IAAI,eAAe,CAQlD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CA8BT;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAsB3F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE;IACP,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CAChC,GACL,oBAAoB,CAkGtB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAE/D;AAID,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAWtE"}

package/dist/lib/ifc/session-ifc.js

@@ -0,0 +1,222 @@
+/**
+ * Session IFC State — Bell-LaPadula enforcement per session
+ *
+ * Tracks the security high-water mark for each session:
+ * - Labels only go UP (weak tranquility / monotonic)
+ * - Taints accumulate and never clear
+ * - Outbound operations are checked against *-property (no write down)
+ * - Users can grant one-shot trusted-subject escalations
+ *
+ * State is in-memory, discarded on session end. New session = clean slate.
+ */
+import { makeLabel, join, dominates, isBottom, formatLabel, BOTTOM, } from './label.js';
+const DEFAULT_STEP_LIMITS = {
+    highly_confidential: 25,
+    confidential: 100,
+};
+/** Max label history entries to keep (prevents unbounded growth in long sessions) */
+const MAX_LABEL_HISTORY = 200;
+// ─── Destination labels for outbound channels ───────────────────────
+const CHANNEL_LABELS = {
+    file_write: BOTTOM, // Overridden by actual file label at check time
+    bash_network: BOTTOM, // Network = public
+    web_fetch: BOTTOM, // Network = public
+    git_commit: BOTTOM, // Commit message = public
+    memory_save: makeLabel(1), // Internal
+};
+// ─── State management ───────────────────────────────────────────────
+export function createSessionIFC() {
+    return {
+        label: BOTTOM,
+        taints: new Set(),
+        outboundStepCount: 0,
+        labelHistory: [],
+        trustedActions: new Set(),
+    };
+}
+/**
+ * Raise the session label (monotonic — can only go up).
+ * Returns true if the label actually changed.
+ */
+export function raiseLabel(state, fileLabel, trigger) {
+    const newLabel = join(state.label, fileLabel);
+    // Check if anything changed
+    if (newLabel.level === state.label.level) {
+        // Check compartments
+        let changed = false;
+        for (const c of newLabel.compartments) {
+            if (!state.label.compartments.has(c)) {
+                changed = true;
+                break;
+            }
+        }
+        if (!changed)
+            return false;
+    }
+    // Record history (capped to prevent unbounded growth)
+    if (state.labelHistory.length < MAX_LABEL_HISTORY) {
+        state.labelHistory.push({
+            timestamp: Date.now(),
+            previousLevel: state.label.level,
+            newLevel: newLabel.level,
+            previousCompartments: [...state.label.compartments],
+            newCompartments: [...newLabel.compartments],
+            trigger,
+        });
+    }
+    state.label = newLabel;
+    return true;
+}
+/**
+ * Add a taint to the session (accumulative, never removed).
+ */
+export function addTaint(state, taint, source) {
+    if (state.taints.has(taint))
+        return;
+    state.taints.add(taint);
+    // Auto-raise label based on taint
+    switch (taint) {
+        case 'secrets_detected':
+            raiseLabel(state, makeLabel(3, ['secrets']), `taint:${taint} from ${source}`);
+            break;
+        case 'credentials_detected':
+            raiseLabel(state, makeLabel(3, ['credentials']), `taint:${taint} from ${source}`);
+            break;
+        case 'pii_detected':
+            raiseLabel(state, makeLabel(2, ['pii']), `taint:${taint} from ${source}`);
+            break;
+        case 'prompt_injection':
+            // Injection doesn't change label, but taints the session
+            break;
+        case 'high_entropy_output':
+            raiseLabel(state, makeLabel(2, ['secrets']), `taint:${taint} from ${source}`);
+            break;
+    }
+}
+/**
+ * Grant a one-shot trusted-subject escalation.
+ * The action ID should be unique per operation (e.g., "bash:curl:step42").
+ */
+export function grantTrustedAction(state, actionId) {
+    state.trustedActions.add(actionId);
+}
+/**
+ * Consume a trusted action (one-shot — removed after use).
+ * Returns true if the action was granted and is now consumed.
+ */
+export function consumeTrustedAction(state, actionId) {
+    return state.trustedActions.delete(actionId);
+}
+// ─── *-Property enforcement (no write down) ─────────────────────────
+/**
+ * Check if an outbound operation is allowed under BLP *-property.
+ *
+ * Graduated enforcement:
+ * - highly_confidential (3): deny all outbound unconditionally
+ * - confidential (2): deny if tainted, ask otherwise
+ * - internal (1): warn only
+ * - public (0): no restriction
+ *
+ * For file_write, caller must provide the destination file's label.
+ */
+export function checkWriteDown(state, channel, options = {}) {
+    // If session is at bottom (clean), always allow
+    if (isBottom(state.label)) {
+        return { allowed: true, action: 'allow' };
+    }
+    // Check one-shot trusted action (consumed on use — delete, not has)
+    if (options.actionId && state.trustedActions.delete(options.actionId)) {
+        return {
+            allowed: true,
+            action: 'allow',
+            reason: 'Trusted action granted by user (one-shot, now consumed)',
+        };
+    }
+    // Determine destination label
+    const destLabel = channel === 'file_write' && options.destinationLabel
+        ? options.destinationLabel
+        : CHANNEL_LABELS[channel];
+    // For file_write: check if destination dominates session (standard BLP)
+    if (channel === 'file_write' && options.destinationLabel) {
+        if (dominates(options.destinationLabel, state.label)) {
+            // Writing to equal or higher classification — always OK
+            return { allowed: true, action: 'allow' };
+        }
+    }
+    // Graduated enforcement by session level
+    const limits = { ...DEFAULT_STEP_LIMITS, ...options.stepLimits };
+    if (state.label.level === 3) {
+        // Highly confidential: deny all outbound (except file_write to same/higher level)
+        if (state.outboundStepCount >= limits.highly_confidential) {
+            return {
+                allowed: false,
+                action: 'deny',
+                reason: `Session has read highly confidential data (step limit ${limits.highly_confidential} reached). ` +
+                    `All outbound operations blocked. Session label: ${formatLabel(state.label)}`,
+            };
+        }
+        return {
+            allowed: false,
+            action: 'deny',
+            reason: `Session has read highly confidential data. ` +
+                `${channel} to ${formatLabel(destLabel)} blocked (no write down). ` +
+                `Session label: ${formatLabel(state.label)}`,
+        };
+    }
+    if (state.label.level === 2) {
+        // Confidential: deny if tainted, ask otherwise
+        if (state.taints.size > 0) {
+            return {
+                allowed: false,
+                action: 'deny',
+                reason: `Session is confidential + tainted (${[...state.taints].join(', ')}). ` +
+                    `${channel} blocked. Session label: ${formatLabel(state.label)}`,
+            };
+        }
+        if (state.outboundStepCount >= limits.confidential) {
+            return {
+                allowed: false,
+                action: 'ask',
+                reason: `Session has read confidential data (step limit ${limits.confidential} approaching). ` +
+                    `${channel} requires approval. Session label: ${formatLabel(state.label)}`,
+            };
+        }
+        return {
+            allowed: false,
+            action: 'ask',
+            reason: `Session has read confidential data. ` +
+                `${channel} to ${formatLabel(destLabel)} requires approval (no write down). ` +
+                `Session label: ${formatLabel(state.label)}`,
+        };
+    }
+    if (state.label.level === 1) {
+        // Internal: warn only (don't block)
+        return {
+            allowed: true,
+            action: 'warn',
+            reason: `Session has read internal data. ` +
+                `${channel} allowed but noted. Session label: ${formatLabel(state.label)}`,
+        };
+    }
+    // Level 0 (public) — no restriction
+    return { allowed: true, action: 'allow' };
+}
+/**
+ * Increment outbound step counter. Call after every outbound operation.
+ */
+export function recordOutboundStep(state) {
+    state.outboundStepCount++;
+}
+export function summarizeIFC(state) {
+    return {
+        level: state.label.level,
+        levelName: formatLabel(state.label).split(' ')[0],
+        compartments: [...state.label.compartments],
+        taints: [...state.taints],
+        outboundStepCount: state.outboundStepCount,
+        historyLength: state.labelHistory.length,
+        trustedActionsCount: state.trustedActions.size,
+        formattedLabel: formatLabel(state.label),
+    };
+}
+//# sourceMappingURL=session-ifc.js.map